Deepnote

Yes. Deepnote's SOC 2 status, frameworks, auditor, and renewal timing are on SOC2C for vendor risk and security reviews. Request the underlying report through SOC2C to complete your third-party risk file.

Deepnote hasn't listed its penetration testing on SOC2C yet. SOC 2 Type II programs typically include periodic third-party penetration tests; the company can add who performed theirs.

Deepnote's SOC 2 report is available on request. Request access through SOC2C and we coordinate the company-side NDA and delivery.

Security isn't a single yes/no, but Deepnote is SOC 2 Type II compliant and holds SOC 2 Type I, SOC 2 Type II, GDPR, CCPA, HIPAA. SOC2C verifies its compliance posture and shows how strongly each fact is proven.

Deepnote hasn't listed a bug bounty or vulnerability disclosure program on SOC2C. Many companies accept security reports at security@deepnote.com or via a /security page (Deepnote lists a security contact).

Deepnote lists 19 subprocessors on its trust center, including Amazon Web Services, Anthropic, Open AI, Google Cloud Platform, Google Workspace. Buyers use this for fourth-party risk review.

Deepnote hosts on AWS, GCP, Azure. Data residency details are on its trust center.

Deepnote's trust center is at https://security.deepnote.com. Its verified SOC 2 status, frameworks, and documents are summarized on its SOC2C profile.

#### Protecting your account We made a decision to not support password login and only use trusted third party login providers, Google and Github. Both support several means of multi-factor authentication (MFA) and have a solid level of security against brute force, or credentials stuffing attacks.   #### Access control for projects Projects have granular role-based access control (RBAC) settings, to allow you to choose what your collaborators can and cannot do. For more details, see the relevant documentation.   #### Defense in depth As we understand that no system will ever be 100% secure, we try to apply defense in depth in design of our apps. One specific example is how we approached identifiers: while we perform authorization checks on all endpoints, Ds for users or projects are high entropy UUIDs. This assures that even if an IDOR would occur in one of our applications, any large-scale exploitation would be much more difficult than with sequential identifiers.   #### Protecting your privacy You control and own your data and, whether it’s your personal or work information, we’re committed to keeping it private. Our privacy policy describes when we collect your information and why.   #### Protecting your source code, data and secrets All files in Deepnote are encrypted at rest, whether they are files you create there or anything you upload. The keys are managed and rotated automatically by our Cloud Service Provider. For sensitive information (such as database integrations or environment variables), we apply a layer of AES-256-CBC encryption before storing them in our database. Decryption keys are stored separately. All data transmitted between Deepnote and our users is protected using Transport Layer Security (TLS), and our Strict-Transport-Security (HSTS) settings assure that your browser will never send an unencrypted request to us.   #### Rigorous security testing We perform security testing on a regular basis to identify and patch…

#### Team equipment All Deepnote team members' computers have up-to-date OS, have a strong passphrases and encrypted storage.   #### Team access We follow the principle of least privilege in how we write design our cloud infrastructure and how we access it. We use Google account authentication with two-factor authentication enforced for all accesses to production systems (many of us utilize FIDO2 tokens).   #### Code reviews Changes to source code destined for production systems are subject to code reviews by qualified engineering peers. We adhere to a secure development lifecycle and review the security implications of every change. Prior to updating production services, the contributors to the updated software version are required to verify that their changes are working as intended in the staging environment.